BerriAI/litellm · error · HTTPException

🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise…

Error message

🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature
🚨 You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. 
Pricing: https://www.litellm.ai/#pricing

What it means

Raised as HTTPException 500 by EnterpriseRouteChecks.is_management_routes_disabled when the DISABLE_ADMIN_ENDPOINTS env var is present in the environment but premium_user is False. Like the LLM API variant, this admin-endpoint lockdown is enterprise-only, and merely having the variable defined triggers the license check before its boolean value is even read.

Solutions

  1. Remove DISABLE_ADMIN_ENDPOINTS from the environment (delete the key, do not set 'false') and restart the proxy
  2. Set a valid LITELLM_LICENSE if you genuinely need admin endpoints disabled
  3. Search all layers for the variable: docker inspect, helm get values, kubectl describe pod, CI secrets
  4. As a community alternative, restrict admin routes with virtual keys/roles instead of the env var

Example fix

# before
export DISABLE_ADMIN_ENDPOINTS=true  # no license -> 500 on startup/requests
# after
unset DISABLE_ADMIN_ENDPOINTS
# or: export LITELLM_LICENSE=<valid-key>
Defensive patterns

Strategy: validation

Validate before calling

import os
if "DISABLE_ADMIN_ENDPOINTS" in os.environ and not licensed():
    # either fail the deploy loudly or strip the var
    raise RuntimeError("DISABLE_ADMIN_ENDPOINTS requires an Enterprise license")

Prevention

When it happens

Trigger: Setting DISABLE_ADMIN_ENDPOINTS in the proxy environment on a community/free deployment; inheriting it from a shared base image or helm values file; setting it to 'false' expecting it to be off (presence still triggers the check).

Common situations: Hardening a proxy by disabling /user, /team, /key admin routes using the env var without a license; env leftovers after a trial expired; helm chart values that define the key globally across environments.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/11074723ba3d7faf. Report an issue: GitHub.

Appendix: source

Thrown at enterprise/litellm_enterprise/proxy/auth/route_checks.py:37

                raise HTTPException(
                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                    detail=f"🚨🚨🚨 DISABLING LLM API ENDPOINTS is an Enterprise feature\n🚨 {CommonProxyErrors.not_premium_user.value}",
                )

        return get_secret_bool("DISABLE_LLM_API_ENDPOINTS") is True

    @staticmethod
    def is_management_routes_disabled() -> bool:
        """
        Check if management route is disabled
        """
        from litellm.proxy._types import CommonProxyErrors
        from litellm.proxy.proxy_server import premium_user
        from litellm.secret_managers.main import get_secret_bool

        if "DISABLE_ADMIN_ENDPOINTS" in os.environ:
            if not premium_user:
                raise HTTPException(
                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                    detail=f"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\n🚨 {CommonProxyErrors.not_premium_user.value}",
                )

        return get_secret_bool("DISABLE_ADMIN_ENDPOINTS") is True

    # Routes that should remain accessible even when LLM API endpoints are disabled.
    # These are read-only model listing routes needed by the Admin UI.
    LLM_API_EXEMPT_ROUTES = ["/models", "/v1/models"]

    @staticmethod
    def should_call_route(route: str):
        """
        Check if management route is disabled and raise exception
        """
        from litellm.proxy.auth.route_checks import RouteChecks

        if (

View on GitHub (pinned to 77b7c6c40c)